From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:38313) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TEKe1-0007RH-Hj for qemu-devel@nongnu.org; Wed, 19 Sep 2012 09:48:54 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TEKdx-0004Wd-EV for qemu-devel@nongnu.org; Wed, 19 Sep 2012 09:48:49 -0400 Received: from isrv.corpit.ru ([86.62.121.231]:50620) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TEKdx-0004WJ-6l for qemu-devel@nongnu.org; Wed, 19 Sep 2012 09:48:45 -0400 Message-ID: <5059CB32.2020605@msgid.tls.msk.ru> Date: Wed, 19 Sep 2012 17:40:02 +0400 From: Michael Tokarev MIME-Version: 1.0 References: <1347525926-28563-1-git-send-email-kraxel@redhat.com> <1347525926-28563-6-git-send-email-kraxel@redhat.com> In-Reply-To: <1347525926-28563-6-git-send-email-kraxel@redhat.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 05/10] qxl: dont update invalid area List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gerd Hoffmann Cc: Alon Levy , qemu-devel@nongnu.org, Dunrong Huang On 13.09.2012 12:45, Gerd Hoffmann wrote: > From: Dunrong Huang > > This patch fixes the following error: > > $ ~/usr/bin/qemu-system-x86_64 -enable-kvm -m 1024 -spice port=5900,disable-ticketing -vga qxl -cdrom ~/Images/linuxmint-13-mate-dvd-32bit.iso > (/home/mathslinux/usr/bin/qemu-system-x86_64:10068): SpiceWorker-CRITICAL **: red_worker.c:4599:red_update_area: condition `area->left >= 0 && area->top >= 0 && area->left < area->right && area->top < area->bottom' failed > Aborted > > spice server terminates QEMU process if we pass invalid area to it, > so dont update those invalid areas. > > Signed-off-by: Dunrong Huang > Signed-off-by: Gerd Hoffmann > --- > hw/qxl.c | 7 +++++++ > 1 files changed, 7 insertions(+), 0 deletions(-) > > diff --git a/hw/qxl.c b/hw/qxl.c > index 257a37d..0176b1a 100644 > --- a/hw/qxl.c > +++ b/hw/qxl.c > @@ -1470,6 +1470,13 @@ async_common: > return; > } > > + if (update.left < 0 || update.top < 0 || update.left >= update.right || > + update.top >= update.bottom) { > + qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: " > + "invalid area(%d,%d,%d,%d)\n", update.left, > + update.right, update.top, update.bottom); > + break; > + } Please take a look at the previous chunk of code, which was added in 511b13e2c9b426b3c56060909693de5097f0b496 "qxl/update_area_io: guest_bug on invalid parameters" by alevy: + if (d->ram->update_surface > NUM_SURFACES) { + qxl_set_guest_bug(d, "QXL_IO_UPDATE_AREA: invalid surface id %d\n", + d->ram->update_surface); + return; + } + if (update.left >= update.right || update.top >= update.bottom) { + qxl_set_guest_bug(d, + "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n", + update.left, update.top, update.right, update.bottom); + return; + } + Now, this place looks.. well.. funny. A (trivial) cleanup patch is on the way. Thanks, /mjt